Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fd9be4ce authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'ro-bind.b6' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 

* 'ro-bind.b6' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: (24 commits)
  [PATCH] r/o bind mounts: debugging for missed calls
  [PATCH] r/o bind mounts: honor mount writer counts at remount
  [PATCH] r/o bind mounts: track numbers of writers to mounts
  [PATCH] r/o bind mounts: check mnt instead of superblock directly
  [PATCH] r/o bind mounts: elevate count for xfs timestamp updates
  [PATCH] r/o bind mounts: make access() use new r/o helper
  [PATCH] r/o bind mounts: write counts for truncate()
  [PATCH] r/o bind mounts: elevate write count for chmod/chown callers
  [PATCH] r/o bind mounts: elevate write count for open()s
  [PATCH] r/o bind mounts: elevate write count for ioctls()
  [PATCH] r/o bind mounts: write count for file_update_time()
  [PATCH] r/o bind mounts: elevate write count for do_utimes()
  [PATCH] r/o bind mounts: write counts for touch_atime()
  [PATCH] r/o bind mounts: elevate write count for ncp_ioctl()
  [PATCH] r/o bind mounts: elevate write count for xattr_permission() callers
  [PATCH] r/o bind mounts: get write access for vfs_rename() callers
  [PATCH] r/o bind mounts: write counts for link/symlink
  [PATCH] r/o bind mounts: get callers of vfs_mknod/create/mkdir()
  [PATCH] r/o bind mounts: elevate write count for rmdir and unlink.
  [PATCH] r/o bind mounts: drop write during emergency remount
  ...
parents b1af9ccc ad775f5a

fs/ext2/ioctl.c

+37 −20
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ 
#include <linux/time.h>

#include <linux/sched.h>

#include <linux/compat.h>

#include <linux/mount.h>

#include <linux/smp_lock.h>

#include <asm/current.h>

#include <asm/uaccess.h>
@@ -23,6 +24,7 @@ long ext2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
	struct ext2_inode_info *ei = EXT2_I(inode);

	unsigned int flags;

	unsigned short rsv_window_size;

	int ret;



	ext2_debug ("cmd = %u, arg = %lu\n", cmd, arg);
@@ -34,14 +36,19 @@ long ext2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
	case EXT2_IOC_SETFLAGS: {

		unsigned int oldflags;



		if (IS_RDONLY(inode))

			return -EROFS;

		ret = mnt_want_write(filp->f_path.mnt);

		if (ret)

			return ret;



		if (!is_owner_or_cap(inode))

			return -EACCES;

		if (!is_owner_or_cap(inode)) {

			ret = -EACCES;

			goto setflags_out;

		}



		if (get_user(flags, (int __user *) arg))

			return -EFAULT;

		if (get_user(flags, (int __user *) arg)) {

			ret = -EFAULT;

			goto setflags_out;

		}



		if (!S_ISDIR(inode->i_mode))

			flags &= ~EXT2_DIRSYNC_FL;
@@ -50,7 +57,8 @@ long ext2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		/* Is it quota file? Do not allow user to mess with it */

		if (IS_NOQUOTA(inode)) {

			mutex_unlock(&inode->i_mutex);

			return -EPERM;

			ret = -EPERM;

			goto setflags_out;

		}

		oldflags = ei->i_flags;
@@ -63,7 +71,8 @@ long ext2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		if ((flags ^ oldflags) & (EXT2_APPEND_FL | EXT2_IMMUTABLE_FL)) {

			if (!capable(CAP_LINUX_IMMUTABLE)) {

				mutex_unlock(&inode->i_mutex);

				return -EPERM;

				ret = -EPERM;

				goto setflags_out;

			}

		}
@@ -75,20 +84,26 @@ long ext2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		ext2_set_inode_flags(inode);

		inode->i_ctime = CURRENT_TIME_SEC;

		mark_inode_dirty(inode);

		return 0;

setflags_out:

		mnt_drop_write(filp->f_path.mnt);

		return ret;

	}

	case EXT2_IOC_GETVERSION:

		return put_user(inode->i_generation, (int __user *) arg);

	case EXT2_IOC_SETVERSION:

		if (!is_owner_or_cap(inode))

			return -EPERM;

		if (IS_RDONLY(inode))

			return -EROFS;

		if (get_user(inode->i_generation, (int __user *) arg))

			return -EFAULT;	

		ret = mnt_want_write(filp->f_path.mnt);

		if (ret)

			return ret;

		if (get_user(inode->i_generation, (int __user *) arg)) {

			ret = -EFAULT;

		} else {

			inode->i_ctime = CURRENT_TIME_SEC;

			mark_inode_dirty(inode);

		return 0;

		}

		mnt_drop_write(filp->f_path.mnt);

		return ret;

	case EXT2_IOC_GETRSVSZ:

		if (test_opt(inode->i_sb, RESERVATION)

			&& S_ISREG(inode->i_mode)
@@ -102,15 +117,16 @@ long ext2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
		if (!test_opt(inode->i_sb, RESERVATION) ||!S_ISREG(inode->i_mode))

			return -ENOTTY;



		if (IS_RDONLY(inode))

			return -EROFS;



		if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))

		if (!is_owner_or_cap(inode))

			return -EACCES;



		if (get_user(rsv_window_size, (int __user *)arg))

			return -EFAULT;



		ret = mnt_want_write(filp->f_path.mnt);

		if (ret)

			return ret;



		if (rsv_window_size > EXT2_MAX_RESERVE_BLOCKS)

			rsv_window_size = EXT2_MAX_RESERVE_BLOCKS;
@@ -131,6 +147,7 @@ long ext2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
			rsv->rsv_goal_size = rsv_window_size;

		}

		mutex_unlock(&ei->truncate_mutex);

		mnt_drop_write(filp->f_path.mnt);

		return 0;

	}

	default:

fs/ext3/ioctl.c

+68 −35
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ 
#include <linux/capability.h>

#include <linux/ext3_fs.h>

#include <linux/ext3_jbd.h>

#include <linux/mount.h>

#include <linux/time.h>

#include <linux/compat.h>

#include <linux/smp_lock.h>
@@ -38,14 +39,19 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
		unsigned int oldflags;

		unsigned int jflag;



		if (IS_RDONLY(inode))

			return -EROFS;

		err = mnt_want_write(filp->f_path.mnt);

		if (err)

			return err;



		if (!is_owner_or_cap(inode))

			return -EACCES;

		if (!is_owner_or_cap(inode)) {

			err = -EACCES;

			goto flags_out;

		}



		if (get_user(flags, (int __user *) arg))

			return -EFAULT;

		if (get_user(flags, (int __user *) arg)) {

			err = -EFAULT;

			goto flags_out;

		}



		if (!S_ISDIR(inode->i_mode))

			flags &= ~EXT3_DIRSYNC_FL;
@@ -54,7 +60,8 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
		/* Is it quota file? Do not allow user to mess with it */

		if (IS_NOQUOTA(inode)) {

			mutex_unlock(&inode->i_mutex);

			return -EPERM;

			err = -EPERM;

			goto flags_out;

		}

		oldflags = ei->i_flags;
@@ -70,7 +77,8 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
		if ((flags ^ oldflags) & (EXT3_APPEND_FL | EXT3_IMMUTABLE_FL)) {

			if (!capable(CAP_LINUX_IMMUTABLE)) {

				mutex_unlock(&inode->i_mutex);

				return -EPERM;

				err = -EPERM;

				goto flags_out;

			}

		}
@@ -81,7 +89,8 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
		if ((jflag ^ oldflags) & (EXT3_JOURNAL_DATA_FL)) {

			if (!capable(CAP_SYS_RESOURCE)) {

				mutex_unlock(&inode->i_mutex);

				return -EPERM;

				err = -EPERM;

				goto flags_out;

			}

		}
@@ -89,7 +98,8 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
		handle = ext3_journal_start(inode, 1);

		if (IS_ERR(handle)) {

			mutex_unlock(&inode->i_mutex);

			return PTR_ERR(handle);

			err = PTR_ERR(handle);

			goto flags_out;

		}

		if (IS_SYNC(inode))

			handle->h_sync = 1;
@@ -115,6 +125,8 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
		if ((jflag ^ oldflags) & (EXT3_JOURNAL_DATA_FL))

			err = ext3_change_inode_journal_flag(inode, jflag);

		mutex_unlock(&inode->i_mutex);

flags_out:

		mnt_drop_write(filp->f_path.mnt);

		return err;

	}

	case EXT3_IOC_GETVERSION:
@@ -129,14 +141,18 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 


		if (!is_owner_or_cap(inode))

			return -EPERM;

		if (IS_RDONLY(inode))

			return -EROFS;

		if (get_user(generation, (int __user *) arg))

			return -EFAULT;



		err = mnt_want_write(filp->f_path.mnt);

		if (err)

			return err;

		if (get_user(generation, (int __user *) arg)) {

			err = -EFAULT;

			goto setversion_out;

		}

		handle = ext3_journal_start(inode, 1);

		if (IS_ERR(handle))

			return PTR_ERR(handle);

		if (IS_ERR(handle)) {

			err = PTR_ERR(handle);

			goto setversion_out;

		}

		err = ext3_reserve_inode_write(handle, inode, &iloc);

		if (err == 0) {

			inode->i_ctime = CURRENT_TIME_SEC;
@@ -144,6 +160,8 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
			err = ext3_mark_iloc_dirty(handle, inode, &iloc);

		}

		ext3_journal_stop(handle);

setversion_out:

		mnt_drop_write(filp->f_path.mnt);

		return err;

	}

#ifdef CONFIG_JBD_DEBUG
@@ -179,18 +197,24 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
		}

		return -ENOTTY;

	case EXT3_IOC_SETRSVSZ: {

		int err;



		if (!test_opt(inode->i_sb, RESERVATION) ||!S_ISREG(inode->i_mode))

			return -ENOTTY;



		if (IS_RDONLY(inode))

			return -EROFS;

		err = mnt_want_write(filp->f_path.mnt);

		if (err)

			return err;



		if (!is_owner_or_cap(inode))

			return -EACCES;

		if (!is_owner_or_cap(inode)) {

			err = -EACCES;

			goto setrsvsz_out;

		}



		if (get_user(rsv_window_size, (int __user *)arg))

			return -EFAULT;

		if (get_user(rsv_window_size, (int __user *)arg)) {

			err = -EFAULT;

			goto setrsvsz_out;

		}



		if (rsv_window_size > EXT3_MAX_RESERVE_BLOCKS)

			rsv_window_size = EXT3_MAX_RESERVE_BLOCKS;
@@ -208,7 +232,9 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
			rsv->rsv_goal_size = rsv_window_size;

		}

		mutex_unlock(&ei->truncate_mutex);

		return 0;

setrsvsz_out:

		mnt_drop_write(filp->f_path.mnt);

		return err;

	}

	case EXT3_IOC_GROUP_EXTEND: {

		ext3_fsblk_t n_blocks_count;
@@ -218,17 +244,20 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
		if (!capable(CAP_SYS_RESOURCE))

			return -EPERM;



		if (IS_RDONLY(inode))

			return -EROFS;



		if (get_user(n_blocks_count, (__u32 __user *)arg))

			return -EFAULT;

		err = mnt_want_write(filp->f_path.mnt);

		if (err)

			return err;



		if (get_user(n_blocks_count, (__u32 __user *)arg)) {

			err = -EFAULT;

			goto group_extend_out;

		}

		err = ext3_group_extend(sb, EXT3_SB(sb)->s_es, n_blocks_count);

		journal_lock_updates(EXT3_SB(sb)->s_journal);

		journal_flush(EXT3_SB(sb)->s_journal);

		journal_unlock_updates(EXT3_SB(sb)->s_journal);



group_extend_out:

		mnt_drop_write(filp->f_path.mnt);

		return err;

	}

	case EXT3_IOC_GROUP_ADD: {
@@ -239,18 +268,22 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
		if (!capable(CAP_SYS_RESOURCE))

			return -EPERM;



		if (IS_RDONLY(inode))

			return -EROFS;

		err = mnt_want_write(filp->f_path.mnt);

		if (err)

			return err;



		if (copy_from_user(&input, (struct ext3_new_group_input __user *)arg,

				sizeof(input)))

			return -EFAULT;

				sizeof(input))) {

			err = -EFAULT;

			goto group_add_out;

		}



		err = ext3_group_add(sb, &input);

		journal_lock_updates(EXT3_SB(sb)->s_journal);

		journal_flush(EXT3_SB(sb)->s_journal);

		journal_unlock_updates(EXT3_SB(sb)->s_journal);



group_add_out:

		mnt_drop_write(filp->f_path.mnt);

		return err;

	}

fs/ext4/ioctl.c

+49 −37
Original line number Diff line number Diff line
@@ -15,6 +15,7 @@ 
#include <linux/time.h>

#include <linux/compat.h>

#include <linux/smp_lock.h>

#include <linux/mount.h>

#include <asm/uaccess.h>



int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
@@ -38,24 +39,25 @@ int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
		unsigned int oldflags;

		unsigned int jflag;



		if (IS_RDONLY(inode))

			return -EROFS;



		if (!is_owner_or_cap(inode))

			return -EACCES;



		if (get_user(flags, (int __user *) arg))

			return -EFAULT;



		err = mnt_want_write(filp->f_path.mnt);

		if (err)

			return err;



		if (!S_ISDIR(inode->i_mode))

			flags &= ~EXT4_DIRSYNC_FL;



		err = -EPERM;

		mutex_lock(&inode->i_mutex);

		/* Is it quota file? Do not allow user to mess with it */

		if (IS_NOQUOTA(inode)) {

			mutex_unlock(&inode->i_mutex);

			return -EPERM;

		}

		if (IS_NOQUOTA(inode))

			goto flags_out;



		oldflags = ei->i_flags;



		/* The JOURNAL_DATA flag is modifiable only by root */
@@ -68,10 +70,8 @@ int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
		 * This test looks nicer. Thanks to Pauline Middelink

		 */

		if ((flags ^ oldflags) & (EXT4_APPEND_FL | EXT4_IMMUTABLE_FL)) {

			if (!capable(CAP_LINUX_IMMUTABLE)) {

				mutex_unlock(&inode->i_mutex);

				return -EPERM;

			}

			if (!capable(CAP_LINUX_IMMUTABLE))

				goto flags_out;

		}



		/*
@@ -79,17 +79,14 @@ int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
		 * the relevant capability.

		 */

		if ((jflag ^ oldflags) & (EXT4_JOURNAL_DATA_FL)) {

			if (!capable(CAP_SYS_RESOURCE)) {

				mutex_unlock(&inode->i_mutex);

				return -EPERM;

			}

			if (!capable(CAP_SYS_RESOURCE))

				goto flags_out;

		}





		handle = ext4_journal_start(inode, 1);

		if (IS_ERR(handle)) {

			mutex_unlock(&inode->i_mutex);

			return PTR_ERR(handle);

			err = PTR_ERR(handle);

			goto flags_out;

		}

		if (IS_SYNC(inode))

			handle->h_sync = 1;
@@ -107,14 +104,14 @@ int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
		err = ext4_mark_iloc_dirty(handle, inode, &iloc);

flags_err:

		ext4_journal_stop(handle);

		if (err) {

			mutex_unlock(&inode->i_mutex);

			return err;

		}

		if (err)

			goto flags_out;



		if ((jflag ^ oldflags) & (EXT4_JOURNAL_DATA_FL))

			err = ext4_change_inode_journal_flag(inode, jflag);

flags_out:

		mutex_unlock(&inode->i_mutex);

		mnt_drop_write(filp->f_path.mnt);

		return err;

	}

	case EXT4_IOC_GETVERSION:
@@ -129,14 +126,20 @@ int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 


		if (!is_owner_or_cap(inode))

			return -EPERM;

		if (IS_RDONLY(inode))

			return -EROFS;

		if (get_user(generation, (int __user *) arg))

			return -EFAULT;



		err = mnt_want_write(filp->f_path.mnt);

		if (err)

			return err;

		if (get_user(generation, (int __user *) arg)) {

			err = -EFAULT;

			goto setversion_out;

		}



		handle = ext4_journal_start(inode, 1);

		if (IS_ERR(handle))

			return PTR_ERR(handle);

		if (IS_ERR(handle)) {

			err = PTR_ERR(handle);

			goto setversion_out;

		}

		err = ext4_reserve_inode_write(handle, inode, &iloc);

		if (err == 0) {

			inode->i_ctime = ext4_current_time(inode);
@@ -144,6 +147,8 @@ int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
			err = ext4_mark_iloc_dirty(handle, inode, &iloc);

		}

		ext4_journal_stop(handle);

setversion_out:

		mnt_drop_write(filp->f_path.mnt);

		return err;

	}

#ifdef CONFIG_JBD2_DEBUG
@@ -179,19 +184,21 @@ int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
		}

		return -ENOTTY;

	case EXT4_IOC_SETRSVSZ: {

		int err;



		if (!test_opt(inode->i_sb, RESERVATION) ||!S_ISREG(inode->i_mode))

			return -ENOTTY;



		if (IS_RDONLY(inode))

			return -EROFS;



		if (!is_owner_or_cap(inode))

			return -EACCES;



		if (get_user(rsv_window_size, (int __user *)arg))

			return -EFAULT;



		err = mnt_want_write(filp->f_path.mnt);

		if (err)

			return err;



		if (rsv_window_size > EXT4_MAX_RESERVE_BLOCKS)

			rsv_window_size = EXT4_MAX_RESERVE_BLOCKS;
@@ -208,6 +215,7 @@ int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
			rsv->rsv_goal_size = rsv_window_size;

		}

		up_write(&ei->i_data_sem);

		mnt_drop_write(filp->f_path.mnt);

		return 0;

	}

	case EXT4_IOC_GROUP_EXTEND: {
@@ -218,16 +226,18 @@ int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
		if (!capable(CAP_SYS_RESOURCE))

			return -EPERM;



		if (IS_RDONLY(inode))

			return -EROFS;



		if (get_user(n_blocks_count, (__u32 __user *)arg))

			return -EFAULT;



		err = mnt_want_write(filp->f_path.mnt);

		if (err)

			return err;



		err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count);

		jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);

		jbd2_journal_flush(EXT4_SB(sb)->s_journal);

		jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);

		mnt_drop_write(filp->f_path.mnt);



		return err;

	}
@@ -239,17 +249,19 @@ int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd, 
		if (!capable(CAP_SYS_RESOURCE))

			return -EPERM;



		if (IS_RDONLY(inode))

			return -EROFS;



		if (copy_from_user(&input, (struct ext4_new_group_input __user *)arg,

				sizeof(input)))

			return -EFAULT;



		err = mnt_want_write(filp->f_path.mnt);

		if (err)

			return err;



		err = ext4_group_add(sb, &input);

		jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);

		jbd2_journal_flush(EXT4_SB(sb)->s_journal);

		jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);

		mnt_drop_write(filp->f_path.mnt);



		return err;

	}

fs/fat/file.c

+7 −5
Original line number Diff line number Diff line
@@ -8,6 +8,7 @@ 


#include <linux/capability.h>

#include <linux/module.h>

#include <linux/mount.h>

#include <linux/time.h>

#include <linux/msdos_fs.h>

#include <linux/smp_lock.h>
@@ -46,10 +47,9 @@ int fat_generic_ioctl(struct inode *inode, struct file *filp, 


		mutex_lock(&inode->i_mutex);



		if (IS_RDONLY(inode)) {

			err = -EROFS;

			goto up;

		}

		err = mnt_want_write(filp->f_path.mnt);

		if (err)

			goto up_no_drop_write;



		/*

		 * ATTR_VOLUME and ATTR_DIR cannot be changed; this also
@@ -106,6 +106,8 @@ int fat_generic_ioctl(struct inode *inode, struct file *filp, 
		MSDOS_I(inode)->i_attrs = attr & ATTR_UNUSED;

		mark_inode_dirty(inode);

up:

		mnt_drop_write(filp->f_path.mnt);

up_no_drop_write:

		mutex_unlock(&inode->i_mutex);

		return err;

	}

fs/file_table.c

+40 −2
Original line number Diff line number Diff line
@@ -42,6 +42,7 @@ static inline void file_free_rcu(struct rcu_head *head) 
static inline void file_free(struct file *f)

{

	percpu_counter_dec(&nr_files);

	file_check_state(f);

	call_rcu(&f->f_u.fu_rcuhead, file_free_rcu);

}
@@ -199,6 +200,18 @@ int init_file(struct file *file, struct vfsmount *mnt, struct dentry *dentry, 
	file->f_mapping = dentry->d_inode->i_mapping;

	file->f_mode = mode;

	file->f_op = fop;



	/*

	 * These mounts don't really matter in practice

	 * for r/o bind mounts.  They aren't userspace-

	 * visible.  We do this for consistency, and so

	 * that we can do debugging checks at __fput()

	 */

	if ((mode & FMODE_WRITE) && !special_file(dentry->d_inode->i_mode)) {

		file_take_write(file);

		error = mnt_want_write(mnt);

		WARN_ON(error);

	}

	return error;

}

EXPORT_SYMBOL(init_file);
@@ -211,6 +224,31 @@ void fput(struct file *file) 


EXPORT_SYMBOL(fput);



/**

 * drop_file_write_access - give up ability to write to a file

 * @file: the file to which we will stop writing

 *

 * This is a central place which will give up the ability

 * to write to @file, along with access to write through

 * its vfsmount.

 */

void drop_file_write_access(struct file *file)

{

	struct vfsmount *mnt = file->f_path.mnt;

	struct dentry *dentry = file->f_path.dentry;

	struct inode *inode = dentry->d_inode;



	put_write_access(inode);



	if (special_file(inode->i_mode))

		return;

	if (file_check_writeable(file) != 0)

		return;

	mnt_drop_write(mnt);

	file_release_write(file);

}

EXPORT_SYMBOL_GPL(drop_file_write_access);



/* __fput is called from task context when aio completion releases the last

 * last use of a struct file *.  Do not use otherwise.

 */
@@ -236,10 +274,10 @@ void __fput(struct file *file) 
	if (unlikely(S_ISCHR(inode->i_mode) && inode->i_cdev != NULL))

		cdev_put(inode->i_cdev);

	fops_put(file->f_op);

	if (file->f_mode & FMODE_WRITE)

		put_write_access(inode);

	put_pid(file->f_owner.pid);

	file_kill(file);

	if (file->f_mode & FMODE_WRITE)

		drop_file_write_access(file);

	file->f_path.dentry = NULL;

	file->f_path.mnt = NULL;

	file_free(file);